Agency classClass IIOur severity:High FDA (Devices)·Z-0988-2024·Announced 2024-02-14

Anesthesia System Cybersecurity Vulnerability Poses Denial of Service Risk

The Flow-i C30 Anesthesia System contains a cybersecurity vulnerability allowing remote attackers to cause denial of service, tampering, or code execution, potentially creating hazardous conditions.

The agency’s classification

FDA (Devices): Class II

Class II is a situation in which use of or exposure to a violative product may cause temporary or medically reversible adverse health consequences, or where the probability of serious adverse health consequences is remote.

This is the agency’s own classification, taken from its notice. The severity score below is our assessment, not the agency’s. How recall classes work

What this means for you

Our assessment, not the agency’s: severity 3/5 (High).

Real risk of harm even if no illness or injury has been reported yet. Stop using the product and follow the agency's guidance.

Our severity reasoning: This is an FDA Class II recall for a cybersecurity vulnerability in a critical-care anesthesia system. While the potential for patient harm is significant—remote code execution or tampering could compromise patient safety during anesthesia delivery—no incidents, injuries, or illnesses have been reported. Per the rubric, risk-of-harm products with no reported injuries score at level 3 (High).

Plain-English summary

The Flow-i C30 Anesthesia System, model 6677300, manufactured by Getinge Usa Sales Inc, has been recalled due to a potential cybersecurity vulnerability. The vulnerability could enable attackers to remotely access the system via remote login and execute denial of service (DoS) attacks, tamper with system operation, or execute arbitrary code, any of which could create hazardous conditions for patients.

The recall affects approximately 4 units in the United States. Affected devices can be identified by serial numbers 1058, 1060, 1167, and 1201.

Healthcare facilities with affected units should immediately contact Getinge Usa Sales Inc to implement any available mitigations or replacement procedures. Physicians and clinical staff should review any guidance provided by the manufacturer regarding the vulnerability and recommended actions.

The recalled product

Product: Flow-i C30 Anesthesia System, model 6677300
Manufacturer: Getinge Usa Sales Inc
Category: Medical Device — Anesthesia Delivery System
Hazard: cybersecurity-vulnerability
denial-of-service
remote-code-execution
tampering
Affected units: 4

Is your product affected?

Check your packaging against the codes below. If any of them match, the product is part of this recall.

Lot numbers (5)

UDI-DI: 07325710001363
serial numbers (US): 1058
1060
1167
1201.

Distribution

Distributed nationwide across the United States.

The notice also names 20 states specifically:

Part of a larger recall action

This product is one of 5 recalled by Getinge Usa Sales Inc under a single FDA (Devices) recall action. The agency files each product separately, so the size of the action is not visible from this page alone.

See all 5 products in this recall →

Same manufacturer · Getinge Usa Sales Inc

See all →

Severe
Sevoflurane Vaporizer Quik-Fil Recalled Due to Chemical Degradation Risk
FDA (Devices) · 2025-02-19
High
Operating Table May Stop Unexpectedly During Surgery Due to Control Error
FDA (Devices) · 2024-11-20
Moderate
Getinge MEERA CL Mobile Operating Table Recalled for Intermittent Movement Errors
FDA (Devices) · 2024-11-20
High
MEERA CL Mobile Operating Table Control Malfunction Recall
FDA (Devices) · 2024-11-20
Moderate
Getinge MEERA CL mobile operating table recalled for sporadic movement errors
FDA (Devices) · 2024-11-20

Same hazard · cybersecurity vulnerability